WeaselBiscuit Stealer Targets Chrome Extension Storage Through 13 npm Packages
A newly identified JavaScript stealer is being distributed through malicious npm packages, putting sensitive browser-extension data used by developers, cryptocurrency users and other internet users at risk.
Cybersecurity researchers have identified 13 npm packages distributing a previously undocumented JavaScript information stealer called WeaselBiscuit. The malware is designed to collect data stored by Chrome extensions across Windows, macOS and Linux systems. Researchers say it shares technical similarities with BeaverTail and OtterCookie, malware families associated with the North Korean-linked Contagious Interview campaign, although there is not enough evidence to conclusively attribute WeaselBiscuit to North Korean operators.
The npm ecosystem is once again facing scrutiny after security researchers uncovered a cluster of malicious packages carrying a new JavaScript information stealer known as WeaselBiscuit.
Unlike some large and feature-heavy information stealers, WeaselBiscuit appears deliberately streamlined. Its primary focus is on browser-extension storage, an area that can contain valuable information depending on the extensions installed on a compromised computer.
The discovery is particularly significant for software developers because npm packages are routinely installed as part of development projects. A malicious dependency can therefore become an unexpected entry point into a developer's computer.
13 npm Packages Linked to the Malware
Researchers identified 13 packages associated with the WeaselBiscuit campaign. Several were published under the @biz44 namespace, while others used separate package names.
The presence of malicious code inside software dependencies illustrates a broader problem facing the modern software industry: developers do not necessarily have to download an obvious executable file to become exposed to malware.
How WeaselBiscuit Gets Into a System
The infection process begins when one of the malicious packages is imported into a project. According to researchers, the package activates a loader that retrieves the main malware from an online Npoint location.
The main payload can then be executed directly in memory. This approach reduces the amount of malicious code that needs to be permanently stored on the infected machine and can make traditional file-based detection more difficult.
Once active, the malware gathers information about the compromised system and searches for Chrome extension storage across Windows, macOS and Linux.
Why Chrome Extension Storage Matters
Browser extensions can store information locally to maintain settings, sessions and other application data. The contents vary considerably between extensions, meaning the information exposed during an attack depends on wha
Security researchers said WeaselBiscuit collects readable, non-empty files from the Local Extension Settings directories used by Chrome extensions. Those files use a LevelDB-based key-value storage system.
That capability can be particularly significant when sensitive extensions are installed. Cryptocurrency wallets, password-management tools and other security-related extensions may maintain valuable information inside browser storage.
Researchers therefore describe the Chrome extension-storage functionality as financially relevant, even though WeaselBiscuit does not contain the more specialized cryptocurrency-wallet draining capabilities seen in some other malware families.
Clipboard and Keystroke Collection
The malware's focus is not limited to extension storage. Researchers found that, depending on commands received from its command-and-control infrastructure, WeaselBiscuit can also collect clipboard contents and record keystrokes on Windows systems.
These capabilities can increase the potential impact of an infection because information copied to a clipboard or typed into a compromised computer may contain credentials, authentication information, private messages or other sensitive material.
Similarities to North Korean Malware
WeaselBiscuit has attracted attention because researchers found functional similarities with BeaverTail and OtterCookie, two malware families associated with the North Korean-linked Contagious Interview campaign.
Researchers also identified several tradecraft similarities, including the use of Npoint.io, certain methods for gathering network and geolocation information, similarities in command-and-control architecture and numerical identifiers associated with installations.
However, OpenSourceMalware has stressed that these similarities do not provide definitive proof that North Korean operators are behind WeaselBiscuit. There is currently insufficient evidence involving infrastructure, victimology, campaign metadata or signing information to make a conclusive attribution.
Technical similarities can provide important clues for cybersecurity investigators, but they do not automatically establish who operated a malware campaign. Attribution requires stronger evidence connecting the code and infrastructure to a specific actor.
A Different Kind of Supply-Chain Threat
The WeaselBiscuit discovery highlights how software supply-chain attacks continue to evolve. Developers often depend on thousands of third-party packages, and malicious code hidden inside a seemingly ordinary dependency can reach environments that contain valuable credentials and proprietary information.
The threat becomes more complicated when developers install packages as part of coding exercises, job interviews, freelance projects or open-source work. In those situations, a developer may trust the project because it appears to be part of a legitimate technical task.
This is one reason security teams increasingly treat software dependencies as part of the organization's attack surface rather than as harmless building blocks.
What Developers and Organizations Can Do
Developers should review newly added npm dependencies carefully and avoid installing packages simply because they appear in an unfamiliar coding task or project. Package names, maintainers, download history and dependency behavior should all be examined before software is introduced into a development environment.
Organizations can strengthen their defenses through dependency scanning, lockfiles, controlled package repositories, endpoint monitoring and least-privilege development environments. Security teams should also monitor unexpected network activity originating from development machines.
Developers who discover one of the identified packages in an active project should treat the system as potentially compromised and follow their organization's incident-response procedures rather than simply deleting the dependency and assuming the problem is solved.
The Bigger Lesson for the npm Ecosystem
WeaselBiscuit is another reminder that the software supply chain is becoming an increasingly important battlefield. Modern developers rely on packages for everything from basic utilities to critical application infrastructure, creating enormous opportunities for attackers who can successfully disguise malicious code as legitimate software.
The malware also demonstrates why browser security cannot be considered separately from developer security. A compromised development machine may contain browser sessions, authentication tools, cryptocurrency extensions, source-code credentials and access to corporate systems.
As software development becomes more connected to cloud services, AI tools and browser-based workflows, protecting the local developer environment is becoming just as important as protecting the production application itself.
The WeaselBiscuit campaign shows that attackers do not always need to break through a company's main defenses. Sometimes, the weakest link can be a single package that a developer trusted enough to install.
Technology, cybersecurity and the future of digital life.
